|
 |
ac7d03 |
From b66796bcd888e0204955913e642d8e45937843dd Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Jan Cholasta <jcholast@redhat.com>
|
|
|
ac7d03 |
Date: Wed, 3 May 2017 06:12:36 +0000
|
|
|
ac7d03 |
Subject: [PATCH] certs: do not export CA certs in install_pem_from_p12
|
|
|
ac7d03 |
|
|
|
ac7d03 |
This fixes `kdc.crt` containing the full chain rather than just the KDC
|
|
|
ac7d03 |
certificate in CA-less server install.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/6831
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/6869
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
ac7d03 |
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
ipaserver/install/certs.py | 2 +-
|
|
|
ac7d03 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
|
|
|
ac7d03 |
index 06a7e2143964484fa45106ca381043eb440dc5b1..02c479d92511fcf4043e7d6798c85cf8256c3299 100644
|
|
|
ac7d03 |
--- a/ipaserver/install/certs.py
|
|
|
ac7d03 |
+++ b/ipaserver/install/certs.py
|
|
|
ac7d03 |
@@ -64,7 +64,7 @@ def get_cert_nickname(cert):
|
|
|
ac7d03 |
|
|
|
ac7d03 |
def install_pem_from_p12(p12_fname, p12_passwd, pem_fname):
|
|
|
ac7d03 |
pwd = ipautil.write_tmp_file(p12_passwd)
|
|
|
ac7d03 |
- ipautil.run([paths.OPENSSL, "pkcs12", "-nokeys",
|
|
|
ac7d03 |
+ ipautil.run([paths.OPENSSL, "pkcs12", "-nokeys", "-clcerts",
|
|
|
ac7d03 |
"-in", p12_fname, "-out", pem_fname,
|
|
|
ac7d03 |
"-passin", "file:" + pwd.name])
|
|
|
ac7d03 |
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.9.4
|
|
|
ac7d03 |
|